Address Spaces for Namespaces
summary
Proposes giving each Linux namespace its own kernel page table (a namespace PGD per namespace) so kernel objects private to that namespace are mapped only there, extends SLB allocators to create exclusive caches and a GFP_EXCLUSIVE* allocation path that marks pages not present in the global direct map, implements a ~200‑line POC for network namespaces that runs TCP inside the protected space, and notes unresolved costs: direct‑map fragmentation, page‑table switching and disabled cross‑namespace socket passing.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:24Address Spaces
- 3:23System Correlation
- 5:15Map Exclusive
- 6:07fragmentation
- 7:57page tables
- 9:10network namespace
- 10:37page allocator
- 11:30page exclusive
- 13:33open questions
- 14:34speaker questions
related talks
30mRestricted Address Spaces for Container Security
01h 03mLinux Namespaces for Fun and Isolation
39mLinux User Namespaces: A Blessing and a Curse
43mAddress Space Isolation for Enhanced Safety of the Linux Kernel
32mLinux user namespaces: a blessing and a curse
57mNamespaces for Security
47mLinux user namespaces: a blessing and a curse
42mWhat's New in the User Namespace